104 lines
7.5 KiB
XML
104 lines
7.5 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!--
|
|
STIG tailoring for the diskless fleet image.
|
|
|
|
Extends the SSG RHEL9 STIG profile and UNSELECTS rules that are structurally
|
|
inapplicable to this architecture (immutable erofs+dm-verity root on a tmpfs
|
|
overlay, UKI/no-GRUB, autologin kiosk, key-only admin, no per-host state) or
|
|
that would be dangerous to auto-remediate (FIPS off per decision; firewall off;
|
|
AIDE = nondeterministic db; smartcard = login lockout). Every unselect here has
|
|
a matching entry in docs/stig-deviations.md with its compensating control.
|
|
|
|
Hand-written (not autotailor) on purpose: oscap reads this directly as a
|
|
tailoring file and silently ignores idrefs that don't exist in the installed
|
|
datastream, so a renamed rule can't break the build — it just won't be waived
|
|
(and will then surface in the generated deviations report for review).
|
|
|
|
Used by oscap xccdf eval against ssg-rhel9-ds.xml, selecting the tailored
|
|
profile id below and passing this file as the tailoring file.
|
|
-->
|
|
<xccdf:Tailoring xmlns:xccdf="http://checklists.nist.gov/xccdf/1.2"
|
|
id="xccdf_org.ssgproject.content_tailoring_diskless">
|
|
<xccdf:benchmark href="/usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml"/>
|
|
<xccdf:version time="2026-06-18T00:00:00">1</xccdf:version>
|
|
|
|
<xccdf:Profile id="xccdf_org.ssgproject.content_profile_stig_diskless"
|
|
extends="xccdf_org.ssgproject.content_profile_stig">
|
|
<xccdf:title>DISA STIG for RHEL 9 — diskless fleet tailoring</xccdf:title>
|
|
<xccdf:description>STIG with rules inapplicable to the diskless/UKI/kiosk architecture unselected; see docs/stig-deviations.md.</xccdf:description>
|
|
|
|
<!-- FIPS: disabled for now (decision). Revisit with signing/Secure Boot. -->
|
|
<xccdf:select idref="xccdf_org.ssgproject.content_rule_enable_fips_mode" selected="false"/>
|
|
<xccdf:select idref="xccdf_org.ssgproject.content_rule_grub2_enable_fips_mode" selected="false"/>
|
|
<xccdf:select idref="xccdf_org.ssgproject.content_rule_package_dracut-fips_installed" selected="false"/>
|
|
|
|
<!-- AIDE / file integrity: dm-verity is the compensating control (whole RO
|
|
root cryptographically verified). AIDE would also add a nondeterministic
|
|
db, breaking the reproducible verity hash. -->
|
|
<xccdf:select idref="xccdf_org.ssgproject.content_rule_package_aide_installed" selected="false"/>
|
|
<xccdf:select idref="xccdf_org.ssgproject.content_rule_aide_build_database" selected="false"/>
|
|
<xccdf:select idref="xccdf_org.ssgproject.content_rule_aide_periodic_cron_checking" selected="false"/>
|
|
<xccdf:select idref="xccdf_org.ssgproject.content_rule_aide_scan_notification" selected="false"/>
|
|
<xccdf:select idref="xccdf_org.ssgproject.content_rule_aide_verify_acls" selected="false"/>
|
|
<xccdf:select idref="xccdf_org.ssgproject.content_rule_aide_verify_ext_attributes" selected="false"/>
|
|
|
|
<!-- Bootloader: UKI, no GRUB. The audit/slub/page-poison/vsyscall/etc kernel
|
|
params are set in the signed UKI cmdline (extract-artifacts.sh) instead —
|
|
the compensating control. GRUB password rules are N/A. -->
|
|
<xccdf:select idref="xccdf_org.ssgproject.content_rule_grub2_uefi_password" selected="false"/>
|
|
<xccdf:select idref="xccdf_org.ssgproject.content_rule_grub2_admin_username" selected="false"/>
|
|
<xccdf:select idref="xccdf_org.ssgproject.content_rule_grub2_audit_argument" selected="false"/>
|
|
<xccdf:select idref="xccdf_org.ssgproject.content_rule_grub2_audit_backlog_limit_argument" selected="false"/>
|
|
<xccdf:select idref="xccdf_org.ssgproject.content_rule_grub2_slub_debug_argument" selected="false"/>
|
|
<xccdf:select idref="xccdf_org.ssgproject.content_rule_grub2_page_poison_argument" selected="false"/>
|
|
<xccdf:select idref="xccdf_org.ssgproject.content_rule_grub2_vsyscall_argument" selected="false"/>
|
|
<xccdf:select idref="xccdf_org.ssgproject.content_rule_grub2_init_on_alloc_argument" selected="false"/>
|
|
<xccdf:select idref="xccdf_org.ssgproject.content_rule_grub2_pti_argument" selected="false"/>
|
|
|
|
<!-- Partitioning: single erofs root + tmpfs overlay; cannot create separate
|
|
/var,/home,/tmp,... partitions. Intent met via nodev/nosuid/noexec tmpfs
|
|
mount options (see provisioner). -->
|
|
<xccdf:select idref="xccdf_org.ssgproject.content_rule_partition_for_var" selected="false"/>
|
|
<xccdf:select idref="xccdf_org.ssgproject.content_rule_partition_for_var_log" selected="false"/>
|
|
<xccdf:select idref="xccdf_org.ssgproject.content_rule_partition_for_var_log_audit" selected="false"/>
|
|
<xccdf:select idref="xccdf_org.ssgproject.content_rule_partition_for_tmp" selected="false"/>
|
|
<xccdf:select idref="xccdf_org.ssgproject.content_rule_partition_for_home" selected="false"/>
|
|
<xccdf:select idref="xccdf_org.ssgproject.content_rule_partition_for_var_tmp" selected="false"/>
|
|
|
|
<!-- Firewall: disabled on the isolated boot LAN (egress controlled at the
|
|
serving/firewall layer). Auto-enabling firewalld/nftables risks the
|
|
NVMe/TCP (4420) + NM paths. Re-enable as future hardening. -->
|
|
<xccdf:select idref="xccdf_org.ssgproject.content_rule_service_firewalld_enabled" selected="false"/>
|
|
<xccdf:select idref="xccdf_org.ssgproject.content_rule_package_firewalld_installed" selected="false"/>
|
|
<xccdf:select idref="xccdf_org.ssgproject.content_rule_set_firewalld_default_zone" selected="false"/>
|
|
|
|
<!-- Remote audit offload: done via rsyslog (provisioner 2f) to the lab
|
|
collector. The audisp-remote native-protocol rules stay waived. -->
|
|
<xccdf:select idref="xccdf_org.ssgproject.content_rule_auditd_audispd_configure_remote_server" selected="false"/>
|
|
<xccdf:select idref="xccdf_org.ssgproject.content_rule_auditd_audispd_encrypt_sent_records" selected="false"/>
|
|
<xccdf:select idref="xccdf_org.ssgproject.content_rule_auditd_audispd_network_failure_action" selected="false"/>
|
|
<xccdf:select idref="xccdf_org.ssgproject.content_rule_rsyslog_remote_loghost" selected="false"/>
|
|
|
|
<!-- rsyslog TLS offload: these force gtls + x509 peer auth + a CA file for ALL
|
|
forwarding. The lab boot LAN is isolated and plaintext (HTTP boot, no
|
|
MACsec); applying them makes rsyslog require TLS and BREAKS the plaintext
|
|
2f forward to serving/audit-collector (no CA, plaintext :514). Waived for
|
|
the lab; TLS offload is tracked as production hardening (docs/TODO.md #2).
|
|
Re-select once the collector has a cert + the CA is bundled in the image. -->
|
|
<xccdf:select idref="xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_defaultnetstreamdriver" selected="false"/>
|
|
<xccdf:select idref="xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_actionsendstreamdrivermode" selected="false"/>
|
|
<xccdf:select idref="xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_actionsendstreamdriverauthmode" selected="false"/>
|
|
|
|
<!-- Smart card: diskless, key-based admin; no PKI/smartcard reader. Enabling
|
|
smartcard-required login would lock the host out. -->
|
|
<xccdf:select idref="xccdf_org.ssgproject.content_rule_require_smart_card_login" selected="false"/>
|
|
<xccdf:select idref="xccdf_org.ssgproject.content_rule_sssd_enable_smartcard" selected="false"/>
|
|
<xccdf:select idref="xccdf_org.ssgproject.content_rule_install_smartcard_packages" selected="false"/>
|
|
|
|
<!-- Admin sudo: the baked admin is key-only (no password), so sudo can't
|
|
prompt for one — NOPASSWD is required for it to function. Documented. -->
|
|
<xccdf:select idref="xccdf_org.ssgproject.content_rule_sudo_remove_nopasswd" selected="false"/>
|
|
|
|
</xccdf:Profile>
|
|
</xccdf:Tailoring>
|